We would know more, but we wouldn't necessarily have an answer. Reading the source code we cannot be sure that some vulnerable software was not updated quickly

We would know more, but we wouldn't necessarily have an answer. Reading the source code we cannot be sure that some vulnerable software was not updated quickly enough on some production system of theirs, or say anything about DNS poising etc.